From mboxrd@z Thu Jan  1 00:00:00 1970
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] minidlna: Update to version 1.3.2
Date: Fri, 19 May 2023 19:04:48 +0200
Message-ID: <20230519170452.3469866-2-adolf.belka@ipfire.org>
In-Reply-To: <20230519170452.3469866-1-adolf.belka@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4663855773791958023=="
List-Id: <development.lists.ipfire.org>

--===============4663855773791958023==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

- Update from version 1.3.0 to 1.3.2
- Update of rootfile not required
- Patch for CVE-2022-26505 is now built into the source tarball
- Changelog
1.3.2 - Released 30-Aug-2022
	- Improved DNS rebinding attack protection.
	- Added Samsung Neo QLED series (2021) support.
	- Added webm/rm/rmvb support.
1.3.1 - Released 11-Feb-2022
	- Fixed a potential crash in SSDP request parsing.
	- Fixed a configure script failure on some platforms.
	- Protect against DNS rebinding attacks.
	- Fix an socket leakage issue on some platforms.
	- Minor bug fixes.

Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
 lfs/minidlna                                  |  7 ++-
 ...x-DNS-rebinding-issue-CVE-2022-26505.patch | 44 -------------------
 2 files changed, 3 insertions(+), 48 deletions(-)
 delete mode 100644 src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-20=
22-26505.patch

diff --git a/lfs/minidlna b/lfs/minidlna
index 1ef104743..d0422c08a 100644
--- a/lfs/minidlna
+++ b/lfs/minidlna
@@ -26,7 +26,7 @@ include Config
=20
 SUMMARY    =3D DLNA compatible server
=20
-VER        =3D 1.3.0
+VER        =3D 1.3.2
=20
 THISAPP    =3D minidlna-$(VER)
 DL_FILE    =3D minidlna-$(VER).tar.gz
@@ -34,7 +34,7 @@ DL_FROM    =3D $(URL_IPFIRE)
 DIR_APP    =3D $(DIR_SRC)/$(THISAPP)
 TARGET     =3D $(DIR_INFO)/$(THISAPP)
 PROG       =3D minidlna
-PAK_VER    =3D 12
+PAK_VER    =3D 13
=20
 DEPS       =3D ffmpeg flac libexif libid3tag libogg
=20
@@ -50,7 +50,7 @@ objects =3D $(DL_FILE)
=20
 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
=20
-$(DL_FILE)_BLAKE2 =3D 3574d48ee63f8c391d1beac653587b87460522178d9f100fe4b0e4=
9f33398b8e527ee74af02d5ea36b23338f7ac73ef3c177edae6be8eed24e94f9db5c8323b0
+$(DL_FILE)_BLAKE2 =3D e35266be94e4585f399c80a6909318ce973d443506f6becdacdb00=
802ed0ce060ebf8401ff1b5dfef0b451f609d98f805c80b9a0c87e23d14084338047418620
=20
 install : $(TARGET)
=20
@@ -84,7 +84,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
 	$(UPDATE_AUTOMAKE)
-	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/minidlna-1.3.0-fix-DN=
S-rebinding-issue-CVE-2022-26505.patch
 	cd $(DIR_APP) && ./configure --prefix=3D/usr
 	cd $(DIR_APP) && make $(MAKETUNING) $(EXTRA_MAKE)
 	cd $(DIR_APP) && make install
diff --git a/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-2650=
5.patch b/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.p=
atch
deleted file mode 100644
index c28425811..000000000
--- a/src/patches/minidlna-1.3.0-fix-DNS-rebinding-issue-CVE-2022-26505.patch
+++ /dev/null
@@ -1,44 +0,0 @@
---- minidlna-1.3.0/upnphttp.c.orig	2020-11-24 19:53:50.000000000 +0100
-+++ minidlna-1.3.0/upnphttp.c	2022-04-30 12:59:23.432073807 +0200
-@@ -273,6 +273,11 @@
- 				p =3D colon + 1;
- 				while(isspace(*p))
- 					p++;
-+				    n =3D 0;
-+				    while(p[n] >=3D ' ')
-+					    n++;
-+				    h->req_Host =3D p;
-+				    h->req_HostLen =3D n;				=09
- 				for(n =3D 0; n < n_lan_addr; n++)
- 				{
- 					for(i =3D 0; lan_addr[n].str[i]; i++)
-@@ -909,6 +914,18 @@
- 	}
-=20
- 	DPRINTF(E_DEBUG, L_HTTP, "HTTP REQUEST: %.*s\n", h->req_buflen, h->req_buf=
);
-+	if(h->req_Host && h->req_HostLen > 0) {
-+		const char *ptr =3D h->req_Host;
-+		DPRINTF(E_MAXDEBUG, L_HTTP, "Host: %.*s\n", h->req_HostLen, h->req_Host);
-+		for(i =3D 0; i < h->req_HostLen; i++) {
-+			if(*ptr !=3D ':' && *ptr !=3D '.' && (*ptr > '9' || *ptr < '0')) {
-+				DPRINTF(E_ERROR, L_HTTP, "DNS rebinding attack suspected (Host: %.*s)",=
 h->req_HostLen, h->req_Host);
-+				Send404(h);/* 403 */
-+				return;
-+			}
-+			ptr++;
-+		}
-+	}=09
- 	if(strcmp("POST", HttpCommand) =3D=3D 0)
- 	{
- 		h->req_command =3D EPost;
---- minidlna-1.3.0/upnphttp.h.orig	2020-11-24 19:53:50.000000000 +0100
-+++ minidlna-1.3.0/upnphttp.h	2022-04-30 13:00:22.619152312 +0200
-@@ -89,6 +89,8 @@
- 	struct client_cache_s * req_client;
- 	const char * req_soapAction;
- 	int req_soapActionLen;
-+	const char * req_Host;        /* Host: header */
-+	int req_HostLen;
- 	const char * req_Callback;	/* For SUBSCRIBE */
- 	int req_CallbackLen;
- 	const char * req_NT;
--=20
2.40.1


--===============4663855773791958023==--